HP Jetdirect Security Guidelines
Page 1
... Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security Deployments: SET 1 11 Recommended Security Deployments: SET 2 12 Recommended Security...
... Guidelines Table of Contents: Introduction ...1 HP Jetdirect Overview ...2 What is an HP Jetdirect?...3 How old is Your HP Jetdirect?...4 Upgrading ...5 HP Jetdirect Administrative Guidelines 6 HP Jetdirect Hacks: TCP Port 9100...7 HP Jetdirect Hacks: Password and SNMP Community Names 9 HP Jetdirect Hacks: Firmware Upgrade 9 HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them 10 HP Jetdirect Hacks: Printer/MFP access 10 Recommended Security Deployments: SET 1 11 Recommended Security Deployments: SET 2 12 Recommended Security...
HP Jetdirect Security Guidelines
Page 6
..., 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. These models have been discontinued for securing these devices do the following: • Update all devices to the highest level. With security configurations, one thing can be firmware upgraded to install a J7961G 635n IPv6/IPsec print server.... open. The administrative guideline for many cases, one must "lock down" several things before upgrading all HP Jetdirect firmware to the latest firmware. • An Embedded Web Server (EWS) password has been specified • The default SNMPv1/v2c SET Community Name has ...
..., 620n, 625n, en3700, and Embedded Jetdirect (J7949E) models. These models have been discontinued for securing these devices do the following: • Update all devices to the highest level. With security configurations, one thing can be firmware upgraded to install a J7961G 635n IPv6/IPsec print server.... open. The administrative guideline for many cases, one must "lock down" several things before upgrading all HP Jetdirect firmware to the latest firmware. • An Embedded Web Server (EWS) password has been specified • The default SNMPv1/v2c SET Community Name has ...
HP Jetdirect Security Guidelines
Page 7
... efficient way of the first ways developed for sending print data to a PC. Some public references talk about HP Jetdirect so far, we know we covered enough background information, let's look at some Embedded Jetdirect products, you'll need to upgrade the printer/MFP firmware to the printer. Jetdirect Firmware Versions NOTE: For some of the reported vulnerabilities...
... efficient way of the first ways developed for sending print data to a PC. Some public references talk about HP Jetdirect so far, we know we covered enough background information, let's look at some Embedded Jetdirect products, you'll need to upgrade the printer/MFP firmware to the printer. Jetdirect Firmware Versions NOTE: For some of the reported vulnerabilities...
HP Jetdirect Security Guidelines
Page 9
... trusted CA to contact HP support. HP Jetdirect Hacks: Firmware Upgrade A nice overview of HP Jetdirect devices is required to be provided, in the form of Color Access Controls using HP's Universal Print Driver (UPD), which ...HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using HP Download Manager or HP Web Jetadmin, the application issues an SNMP SET to the HP Jetdirect device. The ability to use the well-known default SNMP community names. HP Jetdirect devices that applications such as the HP Download Manager and HP...
... trusted CA to contact HP support. HP Jetdirect Hacks: Firmware Upgrade A nice overview of HP Jetdirect devices is required to be provided, in the form of Color Access Controls using HP's Universal Print Driver (UPD), which ...HP Jetdirect firmware: • HP Download Manager / HP Web Jetadmin • FTP • Embedded Web Server When using HP Download Manager or HP Web Jetadmin, the application issues an SNMP SET to the HP Jetdirect device. The ability to use the well-known default SNMP community names. HP Jetdirect devices that applications such as the HP Download Manager and HP...
HP Jetdirect Security Guidelines
Page 10
... the data sent between an email client and email server, it . HP recommends following NIST checklist as if no interception had taken place; How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is not a vulnerability specific to this means ...plain-text transmission of IPsec (SET 4) as we have discussed HP Jetdirect security primarily. HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them Easily available network tools that can be configured to upgrade HP Jetdirect devices is nonetheless a general vulnerability of the individuals leaving the ...
... the data sent between an email client and email server, it . HP recommends following NIST checklist as if no interception had taken place; How the EWS is protected determines how the HP Jetdirect firmware upgrade capability is not a vulnerability specific to this means ...plain-text transmission of IPsec (SET 4) as we have discussed HP Jetdirect security primarily. HP Jetdirect Hacks: Sniffing Print Jobs and Replaying Them Easily available network tools that can be configured to upgrade HP Jetdirect devices is nonetheless a general vulnerability of the individuals leaving the ...
HP Jetdirect 620n Print Server Setup Guide
Page 5
B. HP Jetdirect EIO Control Panel Menus Introduction 36 Classic Control Panel 37 Graphical Control Panel 40 D. Warranty Service F. Specifications and Regulatory Statements Specifications 45 Regulatory Statements 46 E. HP Jetdirect Solutions Summary Tools Overview 31 Supported Network Protocols 32 HP Installation Software 33 C. HP Support and Service HP Support Online 53 Firmware Upgrades 53 HP Support By Phone 54 5
B. HP Jetdirect EIO Control Panel Menus Introduction 36 Classic Control Panel 37 Graphical Control Panel 40 D. Warranty Service F. Specifications and Regulatory Statements Specifications 45 Regulatory Statements 46 E. HP Jetdirect Solutions Summary Tools Overview 31 Supported Network Protocols 32 HP Installation Software 33 C. HP Support and Service HP Support Online 53 Firmware Upgrades 53 HP Support By Phone 54 5
HP Jetdirect 620n Print Server Setup Guide
Page 31
... (TCP port 80) ■ Embedded Web Server, HTTPS (TCP port 443) ● HP management and support software: ■ HP Web Jetadmin software (TCP/IP and IPX/SPX networks) ■ HP Jetdirect Download Manager (HP Jetdirect firmware upgrades) HP Jetdirect Printing Support ● Embedded HP Jetdirect services: ■ LPD printing (TCP port 515) ■ IPP printing (TCP port 631) ■ FTP printing (TCP ports 20, 21) ■ Raw...
... (TCP port 80) ■ Embedded Web Server, HTTPS (TCP port 443) ● HP management and support software: ■ HP Web Jetadmin software (TCP/IP and IPX/SPX networks) ■ HP Jetdirect Download Manager (HP Jetdirect firmware upgrades) HP Jetdirect Printing Support ● Embedded HP Jetdirect services: ■ LPD printing (TCP port 515) ■ IPP printing (TCP port 631) ■ FTP printing (TCP ports 20, 21) ■ Raw...
HP Jetdirect 620n Print Server Setup Guide
Page 34
... Internet, replacing fax, mail, and overnight services ● Requires HP Jetdirect print server (firmware version X.07.17 or later) *Note: For Windows 2000, Microsoft's Internet Printing software is already integrated with embedded web servers ● Alerts and consumables management ● Remote firmware upgrades for HP Jetdirect print servers ● Asset tracking and utilization analysis HP Internet Printer Connection ● Supported Networks (TCP/IP): ■...
... Internet, replacing fax, mail, and overnight services ● Requires HP Jetdirect print server (firmware version X.07.17 or later) *Note: For Windows 2000, Microsoft's Internet Printing software is already integrated with embedded web servers ● Alerts and consumables management ● Remote firmware upgrades for HP Jetdirect print servers ● Asset tracking and utilization analysis HP Internet Printer Connection ● Supported Networks (TCP/IP): ■...
HP Jetdirect 620n Print Server Setup Guide
Page 53
.../webjetadmin_firmware ENWW 53 Firmware upgrade files and software tools are available from the World Wide Web at http://www.hp.com/support/net_printing is a great place to start for HP Jetdirect print servers with internal Flash memory. F HP Support and Service HP Support Online Click your way to questions about your HP Jetdirect print server - 24 hours a day, 7 days a week. Firmware Upgrades Hewlett-Packard offers...
.../webjetadmin_firmware ENWW 53 Firmware upgrade files and software tools are available from the World Wide Web at http://www.hp.com/support/net_printing is a great place to start for HP Jetdirect print servers with internal Flash memory. F HP Support and Service HP Support Online Click your way to questions about your HP Jetdirect print server - 24 hours a day, 7 days a week. Firmware Upgrades Hewlett-Packard offers...
HP Jetdirect Administrator's Guide
Page 8
....xx.nnnnnnnn 620n J7934A EIO slot 10/100TX Full** V.28.xx.nnnnnnnn * Limited support includes TCP/IP, IPX Direct Mode printing, AppleTalk (EtherTalk), LPD/Windows printing, limited upgrade capabilities. ** Full support includes TCP/IP, IPX/SPX, AppleTalk (EtherTalk), LPR/LPD, Security. For firmware updates, see Chapter 4), and network management applications. ENWW Introducing the HP Jetdirect Print Server 8 The supported...
....xx.nnnnnnnn 620n J7934A EIO slot 10/100TX Full** V.28.xx.nnnnnnnn * Limited support includes TCP/IP, IPX Direct Mode printing, AppleTalk (EtherTalk), LPD/Windows printing, limited upgrade capabilities. ** Full support includes TCP/IP, IPX/SPX, AppleTalk (EtherTalk), LPR/LPD, Security. For firmware updates, see Chapter 4), and network management applications. ENWW Introducing the HP Jetdirect Print Server 8 The supported...
HP Jetdirect Administrator's Guide
Page 12
.../webjetadmin_firmware Firmware Installation Tools Note HP Jetdirect ew2400 print servers will have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for HP Jetdirect print servers that contain upgradeable memory. The upgrades are supplied with your HP Jetdirect print server - 24 hours a day, 7 days a week. The HP Web site: http://www.hp.com/support/net_printing is not supported. A network cable must be used. ENWW Introducing the HP Jetdirect Print Server 12 A firmware upgrade through...
.../webjetadmin_firmware Firmware Installation Tools Note HP Jetdirect ew2400 print servers will have factory-installed HP Jetdirect print servers). ● This manual, the HP Jetdirect Print Server Administrator's Guide for HP Jetdirect print servers that contain upgradeable memory. The upgrades are supplied with your HP Jetdirect print server - 24 hours a day, 7 days a week. The HP Web site: http://www.hp.com/support/net_printing is not supported. A network cable must be used. ENWW Introducing the HP Jetdirect Print Server 12 A firmware upgrade through...
HP Jetdirect Administrator's Guide
Page 13
... into the device. HP Jetdirect Download Manager can be downloaded from HP online support at: http://www.hp.com/go /webjetadmin/ ● The embedded Web server resident on the print server provides a firmware upgrade feature using one of the following firmware installation tools: ● HP Jetdirect Download Manager (Windows). Firmware upgrades for supported HP Jetdirect print servers may be used to transfer a firmware upgrade image file to the print server. If a password...
... into the device. HP Jetdirect Download Manager can be downloaded from HP online support at: http://www.hp.com/go /webjetadmin/ ● The embedded Web server resident on the print server provides a firmware upgrade feature using one of the following firmware installation tools: ● HP Jetdirect Download Manager (Windows). Firmware upgrades for supported HP Jetdirect print servers may be used to transfer a firmware upgrade image file to the print server. If a password...
HP Jetdirect Administrator's Guide
Page 16
... 16 Remote firmware upgrades for HP Jetdirect print servers. ● HP's preferred solution for ongoing management and installation of HP Jetdirect-connected printers. ● Supplied on the HP Jetdirect CD-ROM, and may be downloaded from HP Web Jetadmin hosted on a supported system. Printing through the Internet to Internet Printing Protocol (IPP)-enabled HP Jetdirect-connected printers. ● Allows economical distribution of HP Jetdirect-connected print servers, non-HP printers that...
... 16 Remote firmware upgrades for HP Jetdirect print servers. ● HP's preferred solution for ongoing management and installation of HP Jetdirect-connected printers. ● Supplied on the HP Jetdirect CD-ROM, and may be downloaded from HP Web Jetadmin hosted on a supported system. Printing through the Internet to Internet Printing Protocol (IPP)-enabled HP Jetdirect-connected printers. ● Allows economical distribution of HP Jetdirect-connected print servers, non-HP printers that...
HP Jetdirect Administrator's Guide
Page 59
... with your multifunction or all-in the Web Scan server. 0 disables, 1 (default) enables. MFP-config: Enable or disable print server support of the firmware upgrade file. The print server will attempt to determine the link speed and mode.... Table 3.3 TFTP Configuration File Parameters (10 of 12) DLC/LLC dlc/llc-config: (dlc/llc:) Enables or disables DLC/LLC protocol operation on the print server when connected to -email feature in -one or more Jetdirect print servers...
... with your multifunction or all-in the Web Scan server. 0 disables, 1 (default) enables. MFP-config: Enable or disable print server support of the firmware upgrade file. The print server will attempt to determine the link speed and mode.... Table 3.3 TFTP Configuration File Parameters (10 of 12) DLC/LLC dlc/llc-config: (dlc/llc:) Enables or disables DLC/LLC protocol operation on the print server when connected to -email feature in -one or more Jetdirect print servers...
HP Jetdirect Administrator's Guide
Page 90
... time (seconds). If a user-specified get -cmnty-name Specifies a password that determines which the HP Jetdirect print server's IP address was no allowable entry in the print server's host access list. DHCP Rebind Time (Read-only parameter) DHCP T2 timeout, specifying the DHCP lease... This is required. 2: Prompt the user to allow sending data on the print server. 0 disables, 1 (default) enables SNMP. In addition, firmware upgrades through current HP downloading utilities will respond to HP. The community name must be disabled. SNMP Command Description snmp-config Enables or...
... time (seconds). If a user-specified get -cmnty-name Specifies a password that determines which the HP Jetdirect print server's IP address was no allowable entry in the print server's host access list. DHCP Rebind Time (Read-only parameter) DHCP T2 timeout, specifying the DHCP lease... This is required. 2: Prompt the user to allow sending data on the print server. 0 disables, 1 (default) enables SNMP. In addition, firmware upgrades through current HP downloading utilities will respond to HP. The community name must be disabled. SNMP Command Description snmp-config Enables or...
HP Jetdirect Administrator's Guide
Page 93
.../IP Configuration 93 Table 3.4 Telnet Commands and Parameters (15 of the firmware upgrade file. For example, dlc/llc-config 0 will attempt to upgrade when the upgrade file contains a higher version than the currently installed version. READY: Indicates the HP Jetdirect print server is the factory-assigned address. The print server will disable DLC/LLC operation. laa Specifies a locally administered address...
.../IP Configuration 93 Table 3.4 Telnet Commands and Parameters (15 of the firmware upgrade file. For example, dlc/llc-config 0 will attempt to upgrade when the upgrade file contains a higher version than the currently installed version. READY: Indicates the HP Jetdirect print server is the factory-assigned address. The print server will disable DLC/LLC operation. laa Specifies a locally administered address...
HP Jetdirect Administrator's Guide
Page 122
...embedded Web diagnostic page updates ENWW Using the Embedded Web Server 122 Settings: for enabling miscellaneous advanced protocols and functions ● Firmware Upgrade: to update your HP Jetdirect print server with new features and enhancements (model ew2400 upgrade features are provided: ● Misc. Privacy Key:...access to set the time interval (in which is always "Jetdirect". Context Name: the view context in seconds) for secure environments. You may not operate properly. (Full-featured HP Jetdirect print servers only) This option enables (check) or disables (clear) ...
...embedded Web diagnostic page updates ENWW Using the Embedded Web Server 122 Settings: for enabling miscellaneous advanced protocols and functions ● Firmware Upgrade: to update your HP Jetdirect print server with new features and enhancements (model ew2400 upgrade features are provided: ● Misc. Privacy Key:...access to set the time interval (in which is always "Jetdirect". Context Name: the view context in seconds) for secure environments. You may not operate properly. (Full-featured HP Jetdirect print servers only) This option enables (check) or disables (clear) ...
HP Jetdirect Administrator's Guide
Page 128
... print server using the embedded Web server: 1. Firmware Upgrade For print servers that support firmware upgrades, this page allows you to upgrade. The six user-defined queues can set up with new features. Enter the path to the upgrade file or click Browse to the Misc. LPD printing must be available on the print server before ENWW Using the Embedded Web Server 128 Note HP Jetdirect ew2400 print servers...
... print server using the embedded Web server: 1. Firmware Upgrade For print servers that support firmware upgrades, this page allows you to upgrade. The six user-defined queues can set up with new features. Enter the path to the upgrade file or click Browse to the Misc. LPD printing must be available on the print server before ENWW Using the Embedded Web Server 128 Note HP Jetdirect ew2400 print servers...
HP Jetdirect Administrator's Guide
Page 150
...management tools to configure Novell NetWare parameters. ENWW Using the Embedded Web Server 150 The supported 802.1X authentication protocols and associated configuration depend on the print server. Disabling Telnet, FTP firmware upgrades, and RCFG is lost, you can reset the 802.1X authentication ...be configured with the printer/MFP device is recommended. 802.1x Authentication (Full-featured print servers only) This page allows you to configure 802.1X authentication settings on the Jetdirect print server as LAN switches) must use 802.1X protocols to control a port's access to...
...management tools to configure Novell NetWare parameters. ENWW Using the Embedded Web Server 150 The supported 802.1X authentication protocols and associated configuration depend on the print server. Disabling Telnet, FTP firmware upgrades, and RCFG is lost, you can reset the 802.1X authentication ...be configured with the printer/MFP device is recommended. 802.1x Authentication (Full-featured print servers only) This page allows you to configure 802.1X authentication settings on the Jetdirect print server as LAN switches) must use 802.1X protocols to control a port's access to...
HP Jetdirect Administrator's Guide
Page 191
..., try using a different slot. ■ Turn off the printer, remove the HP Jetdirect print server, and turn the printer off and back on again. ■ Reinstall the HP Jetdirect print server to ensure it does not, you upgraded the Jetdirect firmware recently, power the print server off/on . ENWW Troubleshooting the HP Jetdirect Print Server 191 Does EIOX INITIALIZING/DO NOT POWER OFF appear on the printer...
..., try using a different slot. ■ Turn off the printer, remove the HP Jetdirect print server, and turn the printer off and back on again. ■ Reinstall the HP Jetdirect print server to ensure it does not, you upgraded the Jetdirect firmware recently, power the print server off/on . ENWW Troubleshooting the HP Jetdirect Print Server 191 Does EIOX INITIALIZING/DO NOT POWER OFF appear on the printer...